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METHOD WHICH USES A NON-VOLATILE MEMORY TO STORE 
A CRYPTO KEY AND A CHECK WORD FOR AN ENCRYPTION DEVICE 
This application is a continuation-in-part of U.S. Patent 
Application No. 09/505,830, filed February 17, 2000. 



1. Field of the Invention 

The present invention relates generally to a non- 
volatile memory interface for use with an encryption device. 
More particularly, the present invention relates to a method 
which uses a Non-Volatile Memory circuit connected to an 
encryption device for storing a crypto key and an associated 
check word of the crypto key for use by the encryption 
device. 

2 . Description of the Prior Art 

The encryption device used for encrypting data to be 
transmitted to a ground station via a missile's telemetry 
system requires a crypto key to be loaded in the encryption 
device to permit the encryption of the data. The standard 
key loaders used by the military for crypto key loading are 
the KOI-18 and the KYK-13. The KOI-18 is a paper type 
reader that serially outputs the crypto key data and clock 
as a series of electrical pulses. The KYK-13 is an 
electrical device that can store up to three crypto keys 
with their corresponding check word. The KYK-13 outputs 
data in a manner similar to the KOI-18. 
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The missile's telemetry system encryption device 
includes a Non-Volatile Memory circuit which receives the 
crypto key and an associated check word from the key loader . 
Upon receiving the crypto key and check word the Non- 
Volatile Memory circuit will load the encryption device with 
the crypto key and check word and also display the status of 
a load. When power is removed from the encryption device, 
only the Non-Volatile Memory circuit will retain the key 
data including the crypto key. When power is re-applied to 
the encryption system, the Non-Volatile Memory circuit 
automatically reloads the encryption device with the key 
data. The crypto key will remain in the Non-Volatile Memory 
circuit until the crypto key is erased from the circuit. 

While the Non-Volatile Memory circuits used in the past 
perform their intended function of key data storage 
adequately, these circuits generally require substantially 
more space than is currently available on today's state of 
the art missile encryption systems. There is now a need to 
significantly reduce the size of Non-Volatile Memory 
circuits used with a missile's telemetry system encryption 
device. There is also a need to provide a method whereby a 
Non-Volatile Memory circuit stores a crypto key and an 
associated check word which is to be loaded into an 
encryption device allowing the encryption device to encrypt 
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telemetry data for transmission to a ground station, a ship, 
an aircraft or other receiving station. 

SUMMARY OF THE INVENTION 
5 The present invention overcomes some of the 

difficulties of the past including those mentioned above in 
that it comprises a highly effective and efficient method 

13 for storing a crypto key and an associated check word in a 

■ *0 

ffl Non-Volatile Memory circuit which are then loaded into an 

' in 

10y encryption device allowing the encryption device to encrypt 

jjj telemetry data for transmission to a ground station, a ship, 

an aircraft or other receiving station. 

The present invention comprises a method whereby a Non- 

H ... 

Volatile Memory circuit operates as an interface between a 

1E>M key loader and an encryption device and stores therein a 

crypto key and an associated check word for use by the 

encryption device to encrypt telemetry data after a key 

load. 

The method of the present invention includes the steps 
20 of storing a crypto key and an associated check word in the 

EEPROM of an 8-bit microcontroller and then duplicating 
the crypto key and the check word which is stored in a 
backup location of the EEPROM of the 8-bit microcontroller, 
and a step for indicating the status of a load of the crypto 
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key and check word in the microcontroller as well as a step 
for indicating the status of an erase of the crypto key and 
check word from the microcontroller. A pair of light 
emitting diodes connected to the microcontroller indicate 
5 the status of the load of the crypto key and check word 

within the microcontroller as well as the status of an erase 
of the crypto key and checkword from the microcontroller. 
The method also includes the step of turning off the 
p missile's transmitter when a key load occurs to prevent 

iQg transmission of the crypto key and its corresponding check 

Id word. The method further includes a step for erasing the 

crypto key and its associated check word from an EEPROM 
'~ within the microcontroller upon missile launch. This 

\% prevents an enemy force from retrieving the crypto key and 

ISM its associated check word from the missile after launch. 

Q The present invention also provides a step which allows 

the microcontroller to erase the crypto key and its 
associated checkword from its EEPROM upon receiving an 
active erase signal from the missile. The present invention 
20 further provides a step for supplying a master clock signal 

to the microcontroller. A 4 MHz clock signal generator 
supplies the master clock signal to the microcontroller. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

FIG. 1 is a block diagram illustrating a missile's 
telemetry encryption system and external key loader; 

FIG. 2 is a detailed electrical diagram of the Non- 
Volatile Memory circuit of FIG. 1 which comprises the 
present invention; 

FIGS. 3A-3C illustrate timing and data waveforms 
associated with a data transfer between the key loader and 
the Non-Volatile Memory circuit of FIG. 1; and 

FIGS. 4-9 depicts a flow chart for the software used by 
the 8-bit microcontroller of FIG. 2 to load a crypto key 
with its associated check word into the encryption device of 
FIG. 1. 

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 
Referring to FIGS. 1 and 2, there is shown a missile's 
telemetry encryption system which includes a key loader 22 
for loading a crypto key with its corresponding/associated 
check word into a Non-Volatile Memory circuit 20. The key 
loader 22 may be either a KOI-18 or a KYK-13 key loader. It 
should be noted that the KYK-13 key loader can store three 
crypto keys with their corresponding check words. 

Non-Volatile Memory circuit 20 is connected to a KVG-68 
encryption device 24 which allows Non-Volatile Memory 
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circuit 20 to load a crypto key with its corresponding check 
word into the encryption device 24. The encryption device 
24 is connected to a telemeter transmitter 26 which 
transmits encrypted telemetry data from encryption device 24 
5 to a ground station, a ship, an aircraft or other receiving 

station. 

As shown in FIG. 2, Non-Volatile Memory circuit 20 

0 includes an 18-pin Flash/ EEPROM 8-bit microcontroller 32 
IS which stores the crypto key and corresponding check word 

in 

lOfy used by encryption device 24. The 18-pin Flash/ EEPROM 8- 

1 0 bit microcontroller 32 used in the preferred embodiment of 

\ d 

E the present invention is a Model PIC16F84 microprocessor 

1 ^ 

1^ commercially available from Microchip Technology Inc. of 

!*■ Phoenix, Arizona. Connected to microcontroller 32 is a 4 

MHz clock signal generator 34 which supplies the master 

14* 

clock signal to microcontroller 32. 

Referring to FIGS. 1, 2 and 4, there is shown a power 
up circuit comprising a pair of resistors RIO and Rll, a 
diode D2 and a capacitor CI. When power is first applied to 
20 microcontroller 32 upon powering up Non-Volatile Memory 

circuit 20 a logic zero is supplied to the /MCLR input of 
microcontroller 32 clearing microcontroller 32. This logic 
zero then transitions to a logic one which results in 
microcontroller 32 executing the main routine (FIG. 4) of the 
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computer software program within micrcontroller 32. 

The main routine begins at program step 40, proceeding 
to program step 42 which is the initialize_system routine 
illustrated in FIG. 5. The initialize system routine sets 
5 all of the port output signals of microcontroller 32 to 

their initial condition (program step 60) ; initializes the 
interrupts for microcontroller 3 2 (program step 62) and 
(3 initializes the test indicators which are LEDS 36 and 38 

IS (program step 64) . During program step 66 the EEPROM of 

If! 

lQiJ microcontroller 32 is scanned to determined if a valid 

jij crypto key was previously loaded into the EEPROM of 

IU . 

microcontroller 32. If a valid key is detected an internal 

s3 flag is set which allows for a load of the key into 

encryption device 24 by the computer software. 

IfjP During initialization the /VAR_REQ output from 

microcontroller 32 is set high since this signal is an 
active low signal. 

At this time it should be noted that the computer 
software program for microcontroller 3 2 is adapted for 

20 processing two KGV-68 encryption units although only one is 

illustrated in FIG. 1. In a security upgrade configuration 
the software operates in a manner which allows two KGV-68 
encryption units to be loaded with a crypto key and its 
corresponding check word. It should be noted that while 
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FIG. 1 only shows one KVG-68, the non-volatile memory 
comprising the present invention may be easily modified to 
accommodate two KVG-68 encryption units. 

After initialization the ERASE output from 
5 microcontroller 32 is set high since this signal is an 

active low signal. This turns off LED 38. After 
initialization the STATUS output from microcontroller 32 is 
(3 also set high since this signal is an active low signal. 

IB This turns off LED 36. During initialization of 

m 

lOjjj microcontroller 32 the ERASE output and STATUS output from 

ifj microcontroller 32 are pulsed to test the operation of LEDS 

IU 

£ 36 and 38. Setting the ERASE output of microcontroller 32 

n ... 

|5 high indicates that the crypto key has not been erased from 

r\ microcontroller 32. Setting the STATUS output of 

15M microcontroller 32 high indicates that encryption device 24 

is not loaded. 

The XMTR_D I SABLE output from microcontroller 32 is set 
high during initialization to disable transmitter 26. 
The ENCR_SENSE_IN output from microcontroller 3 2 is set low 
20 during initialization indicating that the KVG-68 encryption 

device 24 is not being loaded. The ENCR_FCLK and ENCR_FDATA 
outputs from microcontroller 32 are set high during 
initialization. The clock signal provided by 
microcontroller 32 at the ENCR_FCLK output from 
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microcontroller 32 has an active falling edge necessitating 
that the signal be set high during initialization of 
microcontroller 32. Setting the ENCRFDATA output from 
microcontroller 32 high results in "0" at the ENCR_FDATA 
output of microcontroller 32. 

Referring to FIGS. 1, 2, 4 and 6, during program step 
44, the computer software test for the presence of key 
loader 22. The SENSE_IN line is monitored by 
microcontroller 32 to determine the, presence of key loader 
22. When the SENSE_IN line is high resulting in a "1" at 
the RAO input of microcontroller 32, the computer software 
proceeds to the eeprom_key_load routine of FIG. 6. 

During program step 70 transmitter 26 is disabled by 
microcontroller 32 to prevent possible transmission of the 
crypto key. During program step 72 the /VAR_REQ output from 
microcontroller 32 is set low to request the check word from 
key loader 22. During program step 74 the check word is 
loaded into the EEPROM of microcontroller 32. Program step 
78 waits for an indication that the crypto key will be 
transferred from key loader 22 to the EEPROM of 
microcontroller 32 with the crypto key being loaded into the 
EEPROM of microcontroller 32 during program step 82. 
Microcontroller 32 and the computer software also duplicate 
the crypto key and check word in a backup location in the 
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EEPROM of microcontroller 32. 

During program step 84 an indication is provided that 
the key is present by clearing the ERASE LED 3 6 turning off 
the ERASE LED 36. During program step 86, transmitter 26 is 
enabled by microcontroller 32. During program step 46, the 
computer software returns to the main program of FIG. 4. 

During program step 48, the computer software checks 
for the presence of the crypto key. If the crypto key is 
not present, i.e. the key is not accurately read into 
microcontroller 32, the software returns to program step 44 
to determine if the key loader 22 is present. When key 
loader 22 is present, the computer software will again load 
the crypto key. 

When the crypto key is correctly loaded into 
microcontroller 32, the computer software proceeds to 
program step 50 which is the KGV load attempt decision. 
When a decision is made to load encryption unit 24, the 
computer software proceeds to the routine kgv_key_load of 
FIG. 7 (program step 52). During program step 90, 
transmitter 26 is disabled. 

During program step 92 the KGV sense input 
( ENCR_JSENSE_IN ) is set active, i.e. the logic "one" state, 
to start a load of the crypto key with its corresponding 
check word. Encryption unit 24 then responses with an 



10 



Navy Case No. 82,250 



active low variable request signal ( / ENCR_VAR_RQ ) to 
microcontroller 32 (program step 94) . During program step 
96, there is a set up for the start of the key load 
interrupt within microcontroller 32. During program step 98 
an internal timer within microcontroller 32 is initialized 
and the key load interrupt is enabled for the key loading 
process. 

During program step 100 there is an indication within 
microcontroller 32 that the key should be present. During 
program step 102 a wait routine occurs which allows for 
completion of the key load process. When the key load 
process is complete, which is an internal indication from 
the interrupt routine, the KGV sense input ( ENCR_S ENS E_I N ) 
is set inactive, i.e. a logic "zero" state (program step 
104). 

During program step 106, the computer software 
increments the count to keep track of the key load attempts. 
During program step 108 the computer software sets a flag to 
use the backup key on the next attempt. A second 
crypto key with its corresponding check word are stored in 
the EEPR0M of microcontroller 32. This backup key is 
utilized in the event that the primary key is not 
functional. Loading of the backup crypto key in the KVG-68 
encryption device 24 is determined by acceptance or non- 
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acceptance of the primary crypto key by encryption device 
24. 

During program step 110, the computer software 
determines whether the key is loaded by testing random 
compare input ( / ENCR_RAN_CP ) to microcontroller 32. The 
answer will be no since there is a requirement that the 
routine kgv_key_load of FIG. 7 be processed twice to load 
the crypto key and the check word into encryption device 24. 

At this time it should be noted that the check word is 
loaded first followed by the crypto key. During program 
step 112 the computer software determines whether there has 
been more than three attempts to load the check word and the 
crypto key, which equates to six loops of the routine 
kgv_key_load of FIG. 7. If the answer is "yes" then 
transmitter 26 is enabled during program step 114. When this 
occurs the light emitting diode 36 will blink (program step 
116) to indicate that microcontroller 32 has been 
unsuccessful in its attempt to load encryption device 24. 

When a load of encryption device 24 is successful 
light emitting diode 3 6 remains on (program step 116) . 
During program step 118, the computer software sets an 
internal flag indicating that a key load has been attempted. 
This prevents an inadvertent return to the routine 
kgv_key_load of FIG. 7. 
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The computer software next returns to main routine of 
FIG. 4. During program step 54, a determination is made as 
to whether or not the key should be erased. When the ERASE 
input to microcontroller 32 is high (RA4 input to 
microcontroller 32) , the microcontroller 32 erases the 
check word and the crypto key as well as its backup from the 
EEPROM within microcontroller 32. Five random writes are 
performed within the EEPROM within microcontroller 32. This 
logic one signal, i.e. ERASE signal is provided by the 
loader interface 2 8 or the missile interface 3 0 to the RA4 
input of microcontroller 32. The signal provided by the 
missile interface 30 is substantially higher than digital 
logic levels necessitating the use of additional resistor R9 
in the LAUNCH line connecting missile interface 3 0 to 
microcontroller 32. 

Referring to FIG. 8, the routine for erasing the EEPROM 
within microcontroller 32 is erase_key. Program step 120 
debounces the erase indication signal provided to the RA4 
input to microcontroller 32. Whenever the signal provided 
to the RA4 input to microcontroller 32 is a logic "one", the 
computer software proceeds to program step 124 erasing the 
crypto key with its corresponding check word from the EEPROM 
within microcontroller 32. The erase light, i.e. light 
emitting diode 38 is set, and the load status is displayed 
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during program step 124. 

From the foregoing, it may readily be seen that the 
present invention comprises a new, unique and exceedingly 
useful method which uses a non-volatile memory to store 
a crypto key and a check word for an encryption device which 
constitutes a considerable improvement over the known prior 
art. Many modifications and variations of the present 
invention are possible in light of the above teachings. It 
is to be understood that within the scope of the appended 
claims the invention may be practiced otherwise than as 
specifically described. 
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